5 ms·

In apparent contravention of the GDPR, various parts of the page say that I must agree to their use of my data for third party advertising or I cannot access th

In apparent contravention of the GDPR, various parts of the page say that I must agree to their use of my data for third party advertising or I cannot access the site. They can say that they have a legitimate interest exemption - and they do. Sites must be able to earn money from their content, or they cannot operate. Therefore, they have a "legitimate interest" exemption for this practice (allowed under GDPR) - they cannot provide you with the service you requested because you are unwilling to help pay for it by allowing third party ads. Edit: By the way, none of this addresses the other elephant in the room. TechCrunch is US based, and to my knowledge they do not offer foreign language translations of their site, at least on the .com version of the site. This meets the test under Recital 23, which says that if it doesn’t “envisage” serving EU users, it isn’t even subject to the GDPR. Any privacy notices on TechCrunch.com are essentially a courtesy.

hadrien01 8y ago
It has nothing to do with showing ads or not, it's about the use of your data to show "relevant" ads. Publishers can still show ads.
Nursie 8y ago
> They can say that they have a legitimate interest exemption - and they do They don't. That's not a legitimate interest. Making money from the data is not covered and if it was then the entire law would be moot. > they cannot provide you with the service you requested because you are unwilling to help pay for it by allowing ads. You missed the word targeted there. And the massive background dissemination of data that accompanies them. That's the issue.
- downandout 8y ago
  They don't. That's not a legitimate interest. While I live in the US, I used an EU VPN for a few weeks just to see what would actually happen under GDPR as an EU user. I couldn't stand the popups after a while - GDPR has ruined the user experience of the web for 500 million people. But through that experience I saw that most sites based in the EU are either a) ignoring GDPR entirely, or b) taking the position that showing ads from third party ad networks without specific consent is a "legitimate interest" - whether you agree with that position or not. I also witnessed countless sites that required user consent in order to view content.
  - Nursie 8y ago
    > GDPR has ruined the user experience of the web for 500 million people No, that would be tracking and targeted advertising. No data processing - no need for popups or consent. If you want to sell me out to the highest bidder then you need to ask, and ruin the look of your site. Your problem, not mine. > I saw that most sites based in the EU are either a) ignoring GDPR entirely, or b) taking the position that showing ads from third party ad networks without specific consent is a "legitimate interest" - whether you agree with that position or not. I also witnessed countless sites that required user consent in order to view content. The law hasn't been in place for that long, and it will take a while for things to catch up. Your last two types of site there are specifically disallowed, and the first just naive.
    - merijnv 8y ago
      > showing ads from third party ad networks without specific consent Showing third party ads without consent is perfectly fine. IFF you don't gather, share, or process any personal data in doing so. If they serve static non-personalised ads, that's perfectly GDPR compliant.
      - hadrien01 8y ago
        You could also serve ads relevant to the page, e.g. an article about a country with tourism ads.
  - tremon 8y ago
    It doesn't really matter whether you or I agree with that position. The point is that the GDPR doesn't agree with that position -- and that has been made explicitly in the regulation: https://www.gdpreu.org/the-regulation/key-concepts/legitimate-interest/ https://www.gdpreu.org/the-regulation/key-concepts/legitimat... Even when data processing is necessary to the controller, such legitimate interests must be weighed against “the interests or fundamental rights and freedoms of the data subject”. Should data controllers justify processing without consent based on this subparagraph, they will need to be prepared to prove legitimate interests (a higher burden) relative to the implied general interests of data subjects. So businesses will need to argue that their interest (income) outweighs the interests of their users (not to be sold out). Specifically, when it comes to advertising itself as a legimate interest: Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including profiling to the extent that it is related to such direct marketing, whether with regard to initial or further processing, at any time and free of charge. That right should be explicitly brought to the attention of the data subject and presented clearly and separately from any other information.
icebraining 8y ago
It's hard to say they don't target EU users, when they host a whole conference in Berlin: https://techcrunch.com/events/disrupt-berlin-2019/ https://techcrunch.com/events/disrupt-berlin-2019/
- hadrien01 8y ago
  And if they didn't target EU users they could just delete the ads, like USA Today does on its super fast EU-specific website (https://eu.usatoday.com/ https://eu.usatoday.com/).
Nursie 8y ago
>> it doesn’t “envisage” serving EU users Strange then that "techcrunch.co.uk" redirects to techcrunch.com/europe

hadrien01 8y ago

It has nothing to do with showing ads or not, it's about the use of your data to show "relevant" ads. Publishers can still show ads.

Nursie 8y ago

> They can say that they have a legitimate interest exemption - and they do They don't. That's not a legitimate interest. Making money from the data is not covered and if it was then the entire law would be moot. > they cannot provide you with the service you requested because you are unwilling to help pay for it by allowing ads. You missed the word targeted there. And the massive background dissemination of data that accompanies them. That's the issue.

downandout 8y ago
They don't. That's not a legitimate interest. While I live in the US, I used an EU VPN for a few weeks just to see what would actually happen under GDPR as an EU user. I couldn't stand the popups after a while - GDPR has ruined the user experience of the web for 500 million people. But through that experience I saw that most sites based in the EU are either a) ignoring GDPR entirely, or b) taking the position that showing ads from third party ad networks without specific consent is a "legitimate interest" - whether you agree with that position or not. I also witnessed countless sites that required user consent in order to view content.
- Nursie 8y ago
  > GDPR has ruined the user experience of the web for 500 million people No, that would be tracking and targeted advertising. No data processing - no need for popups or consent. If you want to sell me out to the highest bidder then you need to ask, and ruin the look of your site. Your problem, not mine. > I saw that most sites based in the EU are either a) ignoring GDPR entirely, or b) taking the position that showing ads from third party ad networks without specific consent is a "legitimate interest" - whether you agree with that position or not. I also witnessed countless sites that required user consent in order to view content. The law hasn't been in place for that long, and it will take a while for things to catch up. Your last two types of site there are specifically disallowed, and the first just naive.
  - merijnv 8y ago
    > showing ads from third party ad networks without specific consent Showing third party ads without consent is perfectly fine. IFF you don't gather, share, or process any personal data in doing so. If they serve static non-personalised ads, that's perfectly GDPR compliant.
    - hadrien01 8y ago
      You could also serve ads relevant to the page, e.g. an article about a country with tourism ads.
- tremon 8y ago
  It doesn't really matter whether you or I agree with that position. The point is that the GDPR doesn't agree with that position -- and that has been made explicitly in the regulation: https://www.gdpreu.org/the-regulation/key-concepts/legitimate-interest/ https://www.gdpreu.org/the-regulation/key-concepts/legitimat... Even when data processing is necessary to the controller, such legitimate interests must be weighed against “the interests or fundamental rights and freedoms of the data subject”. Should data controllers justify processing without consent based on this subparagraph, they will need to be prepared to prove legitimate interests (a higher burden) relative to the implied general interests of data subjects. So businesses will need to argue that their interest (income) outweighs the interests of their users (not to be sold out). Specifically, when it comes to advertising itself as a legimate interest: Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including profiling to the extent that it is related to such direct marketing, whether with regard to initial or further processing, at any time and free of charge. That right should be explicitly brought to the attention of the data subject and presented clearly and separately from any other information.

icebraining 8y ago

It's hard to say they don't target EU users, when they host a whole conference in Berlin: https://techcrunch.com/events/disrupt-berlin-2019/ https://techcrunch.com/events/disrupt-berlin-2019/

hadrien01 8y ago
And if they didn't target EU users they could just delete the ads, like USA Today does on its super fast EU-specific website (https://eu.usatoday.com/ https://eu.usatoday.com/).

Nursie 8y ago

>> it doesn’t “envisage” serving EU users Strange then that "techcrunch.co.uk" redirects to techcrunch.com/europe